Tuesday, November 13, 2012

DDoS protection via tcp intercept ( CISCO )

In my daytime job, I work for a major cloud based DDoS mitigation provider. Here we have the luxury of cloud based mitigation services for the major financial and market dot coms types.

Cloud based mitigation is the ONLY way to fully mitigate DDoS/DoS attacks imho. It's smart, correct and superb when compared to legacy mitigation methods and devices ( ACL, IPS,FW-attach thresholds, FW DOS-anomaly engines,etc......)

Attempts at doing this mitigation locally ( at the customer edge ) is doomed to fail in most cases due to any of the following;

hardware resources are over taxed

even if your local router/firewall/ips blocks the attack traffic, your link is still over utilized and wasted bandwidth

more man-power from your IT staff is required ( during the duration of the attack)

your ISP links have no way to distribute the attack traffic

your ISP can only contribute very little to no-Support in their effort to help you

and it takes time for your ISP to place filters or policy rate limits

you have no way to fully determine if the attack has really subsided until you lift the lid to peek " so-to-speak"

Okay so what's this tcp intercept thing?

Will if you are stuck on a a cisco and have no cloud DDoS mitigation provider, you have a limited means to protect against TCP- SYN-FLOODS ( aka half-opens )

The router is not the best approach for this, due to it's limited cpu/memory and in a hugh sustained attacked, your router could become it's own denial-of-service :). But for low volume or amateurish tcp-SYN floods, you can deploy the tcp intercept feature as provided in most all cisco router codes starting from ios12.3 and onwards.

In order to understand the tcp-intercept, we need to re-educated one's self on the 3-way tcp-hand-shake. This hand shakes happens every time & for all tcp-sessions, when a validate tcp-session is being requested.

The attacker community & underground, uses this knowledge to launch half-opens attacks, by not completing the third step of the 3way hand-shake.

Here's the tcp-handshake 3 steps;

1: client sends a SYN --------> to Server ( this is the 1st packet for tcp and holds the client SPORT, server DPORT, MSS value, and any tcp-options )2: Server sends a SYN/ACK to the --------------> client ( server sends his tcp MSS, tcp-options in this port back and startng seq# )

3: client acks the SYN/ACK with a ack to ---------> the server ( the final steps before we can start sending data )

Step #3 is what DOES NOT happen when a syn-flood attack takes place. As a matter of fact, the sender is probably using a spoof'd & random addres.

So in this attack, you try to exhaust a server tcp-session table, which directly impacts memory consumption. As more and more half-open sessions are being handle, the server can ultimately come to it's knees, drop valid sessions, or worst of all CRASH and Burn :)

Okay so how do we mitigate this on a cisco router?

We use the tcp intercept feature. Here's the steps;

1: we craft a ACL. It's highly suggestive to always build a acl to protect just the server(s) and service(s) that you want DDoS mitigation for. A open "ANY ANY" or all, would cause intercept to take place for ALL tcp-sessions, which can drive the device CPU high, during the inspection process.

It's also ideal to place the trusted internal networks into a deny statement, before the final permits. For example, let's say you have a classic internal/dmz/external interfaces;

internal 172.18.0.0/24dmz 172.19.0.0/24external 7.7.7.0/30

You might want to or not want to inspect traffic from dmz to internal or internal to dmz. So a ACL could be drafted like this;

The latter only watches for the step #3 of the tcp 3-way handshake, and if not completed, it jumps in and send a RST ( reset ) to the server by spoof'ing the source address of the attacker that send the invalid SYN to begin with.

tcp intercept mode intercept | watch

With intercept mode, the router is always in the middle and send a SYN/ACK back on behalf of the client while watching for the final ACK in t he 3rd step of the tcp 3-way handshake. If the client is validate, the router will allow the sessions to complete. The Intercept mode, is more proccess intensive on the router/firewall/mitigation gear.

And finally we monitor the tcp intercept connection and statistic tables. Here's a snippet of those tables;

ccie01#show tcp intercept statistics Intercepting new connections using access-list DDOS-protect205 incomplete, 0 established connections (total 205)141 connection requests per minute
Notice the counters named incomplete? That will increase for every sessions that has been mitigated by the router.

Things to keep in mind;

1: the router can only handle so much traffic ( half-opens ) and could fail-open if the number of sessions exceed it's hardware limit

2: this is best effort only , and with a high PEAKs based attack and 500K plus random sources, the router CPU could climb & cause other issues

3: cisco provides very limited tweaking in regards to this imho , once again best-effort

Okay you want to see how easy it is to launch a tcp syn-flood using 2 of my favorite attack tools :)

3 comments:

The ddos attacks have been evolved from brute force attacks at the layer of networking which is very sophisticated, very hard to detect at the layer of application. Attackers must always learn the threshold of activity that is acceptable for the individual. After that it should be able to sneak inside an unperceived increase in trafficking of network. In the whole of context of network, the boosted traffic is not some issue but if the application that is targeted has very little tolerance, then the attack will be able to take the application down. http://psychzz.weebly.com/

So true but the traffic can be inspected to determine anomalies. DDoS providers like Prolexic have sensors and tools to inspect for this in all layers from OSI layer3 to 7. Then we have the ability to stack proxies to further mitigate traffic that's deemed unwanted.

In case, the traffic and anomalies can easily be tracked and mitigated with the right sensors and tools.